fix(release): avoid shell interpolation of release tag

[HikaruEgashira]

Motivation

• The consolidated release workflow read the tag into a shell script using the GitHub expression github.ref_name, which can contain shell metacharacters and enable command substitution and arbitrary command execution in CI.

Description

• Replace TAG="${{ github.ref_name }}" with TAG="$GITHUB_REF_NAME" in .github/workflows/release.yml inside the Get version step so the runner-provided environment variable is used and shell interpolation of untrusted tag contents is avoided.

Testing

• Ran git diff --check which passed.
• Executed a Python check that asserts TAG="$GITHUB_REF_NAME" is present and TAG="${{ github.ref_name }}" is not in .github/workflows/release.yml, which succeeded.

---

Codex Task